Is CVE-2026-32230 actively exploited?

No active exploitation of CVE-2026-32230 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32230 be exploited remotely?

Yes. CVE-2026-32230 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32230?

CVE-2026-32230 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32230

MEDIUM

CVE-2026-32230

CWE-862Published: March 12, 2026· Updated: Mar 13, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.6th

Official Description

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

NVD Source

Technical Analysis

CVE-2026-32230 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.